Buffer overflow in Qualcomm products - CVE-2023-28579

Vulnerability identifier: #VU83674

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28579

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in WLAN Host. A local privileged application can execute arbitrary code.

WCN3680B
SA8295P
Snapdragon 8 Gen 1 Mobile Platform
SW5100
SW5100P
WCD9341
WCD9370
WCD9380
WCN3660B
SA8195P
WCN3950
WCN3980
WCN3988
WSA8810
WSA8815
WSA8830
WSA8835
Qualcomm Video Collaboration VC1 Platform
FastConnect 7800
QAM8295P
QCA6391
QCA6595AU
QCA6696
QCS410
QCS610
FastConnect 6900
Qualcomm Video Collaboration VC3 Platform
SA6145P
SA6150P
SA8145P
SA8150P
SA8155P
Pixel
QCA6574AU
SA6155P

Install security update from vendor's website.

Pixel - update to 2023-12-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Pixel